WEBVTT

1
00:00.000 --> 00:05.840
Have you ever gone to a corporate site, maybe as a guest, and you fire up your

2
00:05.840 --> 00:06.600
laptop and

3
00:06.600 --> 00:10.120
you find that the network is actually completely open?

4
00:10.120 --> 00:12.320
And so you think, "Oh, okay, great.

5
00:12.320 --> 00:14.120
I'm just going to join this network then.

6
00:14.120 --> 00:17.600
I don't have to provide a username and password or anything like that."

7
00:17.600 --> 00:21.640
And we associate and authenticate to the access point we connect.

8
00:21.640 --> 00:27.190
And then I try to go to a website and all of a sudden I'm redirected to a web

9
00:27.190 --> 00:28.120
portal.

10
00:28.120 --> 00:32.760
And at this point, I have to provide some kind of authentication mechanism.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:28.120 --> 00:32.760
And at this point, I have to provide some kind of authentication mechanism.

11
00:32.760 --> 00:37.680
And usually at this point, it's going to be a username and password.

12
00:37.680 --> 00:42.920
This is known as web auth or web authentication.

13
00:42.920 --> 00:46.920
And it's just another tool in our belt, a way that we can help our users get

14
00:46.920 --> 00:47.400
onto our

15
00:47.400 --> 00:52.080
wireless network without maybe going with one of the other options.

16
00:52.080 --> 00:55.760
So if we think about our options, we have now web auth in here.

17
00:55.760 --> 01:00.870
We also have the concept of pre-shared key and then we have our enterprise
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

17
00:55.760 --> 01:00.870
We also have the concept of pre-shared key and then we have our enterprise

18
01:00.870 --> 01:01.760
option.

19
01:01.760 --> 01:05.440
Well when we look at pre-shared key, we understand that there's a whole lot of

20
01:05.440 --> 01:06.280
downside, a whole

21
01:06.280 --> 01:07.280
lot of cons.

22
01:07.280 --> 01:11.790
It has to do with scalability and potentially security risks and so on and so

23
01:11.790 --> 01:12.480
forth.

24
01:12.480 --> 01:18.020
But keep in mind that even though there's a lot of downsides, it's very easy to

25
01:18.020 --> 01:18.920
operate.

26
01:18.920 --> 01:23.200
Whereas enterprise, even though there's a lot of pros, it's also a little bit

27
01:23.200 --> 01:23.680
complex

28
01:23.680 --> 01:25.040
to set up.

29
01:25.040 --> 01:27.560
I might need to put a certificate onto a laptop.

30
01:27.560 --> 01:32.720
I might need to ask a user to use multi-factor authentication.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
01:27.560 --> 01:32.720
I might need to ask a user to use multi-factor authentication.

31
01:32.720 --> 01:36.920
Whatever the situation is, we know that this is a little bit more complex.

32
01:36.920 --> 01:40.860
Web auth aims to go kind of right in the middle here because we're trying to

33
01:40.860 --> 01:41.440
get a little

34
01:41.440 --> 01:48.810
bit easier access to our wireless network and yet still have some of the pros

35
01:48.810 --> 01:49.480
of our

36
01:49.480 --> 01:50.480
enterprise.

37
01:50.480 --> 01:56.920
Remember, pre-shared key lacks authentication, it relies on the pre-shared key.

38
01:56.920 --> 02:00.800
So what we're trying to do here is reintroduce the idea of authentication.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:56.920 --> 02:00.800
So what we're trying to do here is reintroduce the idea of authentication.

39
02:00.800 --> 02:04.760
Now I have to log in with a username and password.

40
02:04.760 --> 02:06.680
And yet it's still very easy.

41
02:06.680 --> 02:08.120
The wireless network was open.

42
02:08.120 --> 02:12.160
I didn't need to do anything complex to get on board.

43
02:12.160 --> 02:15.980
Now that said, there is a downside because even though web auth as the name

44
02:15.980 --> 02:16.800
implies here

45
02:16.800 --> 02:22.040
provides authentication, it doesn't provide encryption.

46
02:22.040 --> 02:26.960
Now we could potentially pair up with WPA pre-shared key in order to provide

47
02:26.960 --> 02:27.920
the encryption.

48
02:27.920 --> 02:30.040
But at that point, what are we doing here?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
02:27.920 --> 02:30.040
But at that point, what are we doing here?

49
02:30.040 --> 02:33.820
We might as well go ahead and migrate over to our enterprise side rather than

50
02:33.820 --> 02:34.280
trying to

51
02:34.280 --> 02:36.840
deploy a WPA pre-shared key.

52
02:36.840 --> 02:40.940
So in most situations that we're deploying web auth, we're going to have no

53
02:40.940 --> 02:41.880
encryption.

54
02:41.880 --> 02:42.880
So why?

55
02:42.880 --> 02:44.400
Why would we go with web auth?

56
02:44.400 --> 02:47.320
What is the purpose of using this?

57
02:47.320 --> 02:52.440
Well once again, it's to provide somewhat easy access to the network.

58
02:52.440 --> 02:56.160
And it's also supposed to provide actual real authentication.

59
02:56.160 --> 03:01.060
I'll say real here, potentially in quotes, because we're using a username and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:56.160 --> 03:01.060
I'll say real here, potentially in quotes, because we're using a username and

60
03:01.060 --> 03:01.880
password,

61
03:01.880 --> 03:05.360
we're not relying on a pre-shared key.

62
03:05.360 --> 03:10.390
But because we're not encrypting the traffic, usually at this point, we're

63
03:10.390 --> 03:11.360
going to find

64
03:11.360 --> 03:14.600
that this is reserved for guest access.

65
03:14.600 --> 03:17.960
As I mentioned at the start, maybe we showed up at a corporate site.

66
03:17.960 --> 03:22.050
We're there for a meeting, a sales pitch, whatever the reason is, we're there

67
03:22.050 --> 03:22.560
and they

68
03:22.560 --> 03:26.080
tell us, hey, we can log in and use the Wi-Fi.

69
03:26.080 --> 03:29.720
And all they had to do was provide us with maybe a username and password, like

70
03:29.720 --> 03:30.180
a print
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
03:29.720 --> 03:30.180
a print

71
03:30.180 --> 03:31.680
out, that kind of thing.

72
03:31.680 --> 03:34.710
And so I fill in the username and password and I'm able to get onto their

73
03:34.710 --> 03:35.600
wireless network

74
03:35.600 --> 03:37.280
very seamlessly.

75
03:37.280 --> 03:41.070
And yet, anybody else, the threat actors who are out there, even though this

76
03:41.070 --> 03:41.760
network is

77
03:41.760 --> 03:46.690
open, they're not able to get on because they lack the username and password

78
03:46.690 --> 03:47.360
that I was

79
03:47.360 --> 03:53.300
provided at the official meeting at the front desk or whatever the situation is

80
03:53.300 --> 03:54.040
there.

81
03:54.040 --> 04:00.200
So at this point, this becomes known as a layer three security mechanism.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
03:54.040 --> 04:00.200
So at this point, this becomes known as a layer three security mechanism.

82
04:00.200 --> 04:05.160
Because it's open here, the layer two mechanism is essentially non-existent.

83
04:05.160 --> 04:08.740
I don't have layer two security because my wireless device was able to

84
04:08.740 --> 04:09.600
associate to the

85
04:09.600 --> 04:14.920
access point without ever providing any kind of authentication mechanism.

86
04:14.920 --> 04:19.100
Layer three security says, hey, let's just go ahead and get you wirelessly

87
04:19.100 --> 04:19.880
associated,

88
04:19.880 --> 04:21.280
no problem.

89
04:21.280 --> 04:26.000
And then we'll worry about security on the back end.

90
04:26.000 --> 04:30.530
So what this means is that my device is going to perform again my
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
04:26.000 --> 04:30.530
So what this means is that my device is going to perform again my

91
04:30.530 --> 04:32.760
authentication and association

92
04:32.760 --> 04:34.600
to this access point.

93
04:34.600 --> 04:39.160
And then from a network perspective, I'm actually going to get DHCP.

94
04:39.160 --> 04:40.600
So I've got an IP address.

95
04:40.600 --> 04:42.200
I'm going to get DNS.

96
04:42.200 --> 04:45.960
I've got the ability to get out to the web.

97
04:45.960 --> 04:49.200
And yet going out to the web is going to redirect me.

98
04:49.200 --> 04:51.120
So that's exactly what ends up happening.

99
04:51.120 --> 04:58.520
I usually point my web browser to a www type of site, whatever that is, and I

100
04:58.520 --> 05:00.080
get redirected
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
04:58.520 --> 05:00.080
get redirected

101
05:00.080 --> 05:02.680
to the web portal.

102
05:02.680 --> 05:08.200
Now here's a question, where exactly does this portal get hosted?

103
05:08.200 --> 05:13.400
Because this is a real web page, I need a real web server to host a real web

104
05:13.400 --> 05:14.160
page.

105
05:14.160 --> 05:18.570
Well fortunately for us, Cisco does give us the option of this being hosted on

106
05:18.570 --> 05:19.340
the wireless

107
05:19.340 --> 05:21.140
LAN controller.

108
05:21.140 --> 05:24.360
We'll see that there is a pretty seamless option for me just to, or simple

109
05:24.360 --> 05:24.920
option to

110
05:24.920 --> 05:28.780
get onto the wireless LAN controller configuration and tell it, hey, I want you

111
05:28.780 --> 05:29.640
to manage the

112
05:29.640 --> 05:30.800
portal.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
05:29.640 --> 05:30.800
portal.

113
05:30.800 --> 05:35.050
And so at this point, this is really connecting to an internal web server on

114
05:35.050 --> 05:35.960
the wireless

115
05:35.960 --> 05:37.320
LAN controller.

116
05:37.320 --> 05:40.560
This would be known as an internal portal.

117
05:40.560 --> 05:48.310
However, I can also connect to an actual web server, which would be known as an

118
05:48.310 --> 05:49.400
external

119
05:49.400 --> 05:53.840
connection.

120
05:53.840 --> 05:57.640
The external web server allows for max customization.

121
05:57.640 --> 06:02.090
So if I want the web portal to look exactly like I want it to look, then I
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
05:57.640 --> 06:02.090
So if I want the web portal to look exactly like I want it to look, then I

122
06:02.090 --> 06:03.160
should go out

123
06:03.160 --> 06:06.120
and create my own web page on a web server.

124
06:06.120 --> 06:11.260
The internal WLC wireless LAN controller hosted website is going to allow for

125
06:11.260 --> 06:12.400
customization.

126
06:12.400 --> 06:18.010
I can usually put my company logo on there and probably edit the text in there,

127
06:18.010 --> 06:18.200
but there's

128
06:18.200 --> 06:20.200
not much I can do beyond that.

129
06:20.200 --> 06:23.280
And so this is a very basic web portal.

130
06:23.280 --> 06:26.600
If I wanted to look really super professional, then I would have to do

131
06:26.600 --> 06:27.720
something involving

132
06:27.720 --> 06:29.640
an external web server.

133
06:29.640 --> 06:32.970
But for the most part, the vast majority of wireless networks that I've
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

133
06:29.640 --> 06:32.970
But for the most part, the vast majority of wireless networks that I've

134
06:32.970 --> 06:34.040
personally deployed

135
06:34.040 --> 06:38.770
or interacted with, we're usually using the basic portal because we're not

136
06:38.770 --> 06:39.800
trying to impress

137
06:39.800 --> 06:44.400
a whole lot of people with our guest access web portal.

138
06:44.400 --> 06:48.780
So web auth is certainly an option that we can not only enable for the sake of

139
06:48.780 --> 06:49.720
simplicity.

140
06:49.720 --> 06:53.220
Again, trying to figure out how to make it easier for our guests to get online

141
06:53.220 --> 06:53.600
while

142
06:53.600 --> 06:56.760
still providing some amount of security around this.

143
06:56.760 --> 07:00.800
I still have to provide a username and password to my guests to log in.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

143
06:56.760 --> 07:00.800
I still have to provide a username and password to my guests to log in.

144
07:00.800 --> 07:03.640
So I'm trying to find that balance.

145
07:03.640 --> 07:07.720
But I'm also still again trying to keep these threat actors out.

146
07:07.720 --> 07:12.250
And so web auth is a great way to create a great method maybe to consider for

147
07:12.250 --> 07:12.840
my guest

148
07:12.840 --> 07:18.680
access to bridge the gap and not require either running pre shared key, which

149
07:18.680 --> 07:19.120
is not

150
07:19.120 --> 07:23.920
the best, but also not running full WPA enterprise for my guests.